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Abstract 



Quantum computers use the quantum interference of different computational paths to en- 
hance correct outcomes and suppress erroneous outcomes of computations. In effect, they follow 
the same logical paradigm as (multi-particle) interferometers. We show how most known quan- 
turn algorithms, including quantum algorithms for factorising and counting, may be cast in this 
, manner. Quantum searching is described as inducing a desired relative phase between two eigen- 

' vectors to yield constructive interference on the sought elements and destructive interference on 

I the remaining terms. 

a\ 
^, 

p ^' 1 From Interferometers to Computers 

Ch \ Richard Feynman 0| in his talk during the First Conference on the Physics of Computation held at 



^ ' MIT in 1981 observed that it appears to be impossible to simulate a general quantum evolution on 

a classical probabilistic computer in an efficient way. He pointed out that any classical simulation of 
quantum evolution appears to involve an exponential slowdown in time as compared to the natural 
evolution since the amount of information required to describe the evolving quantum state in classical 
■ terms generally grows exponentially in time. However, instead of viewing this as an obstacle, Feynman 

\ regarded it as an opportunity. If it requires so much computation to work out what will happen in a 

complicated multiparticle interference experiment then, he argued, the very act of setting up such an 
experiment and measuring the outcome is tantamount to performing a complex computation. Indeed, 
all quantum multiparticle interferometers are quantum computers and some interesting computational 
problems can be based on estimating internal phase shifts in these interferometers. This approach 
leads to a unified picture of quantum algorithms and has been recently discussed in detail by Cleve 
et al. §. 

Let us start with the textbook example of quantum interference, namely the double-slit experiment, 
which, in a more modern version, can be rephrased in terms of Mach-Zehnder interferometry (see 
Fig. 0). 

A particle, say a photon, impinges on a beam-splitter (BSl), and, with some probability amplitudes, 
propagates via two different paths to another beam-splitter (BS2) which directs the particle to one 
of the two detectors. Along each path between the two beam-splitters, is a phase shifter (PS). If the 
lower path is labelled as state | 0) and the upper one as state | 1) then the particle, initially in path 
I 0) , undergoes the following sequence of transformations 

|o) ^ -L(|o) + |i)) 
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Figure 1: A Mach-Zehndcr interferometer with two phase shifters. The interference pattern depends 
on the difference between the phase shifts in different arms of the interferometer. 

^ -L(e^^o I 0) + I 1)) = i=(e'^ | 0) + | 1)) 

^ e'^(cosi(.^o-</'i)|O)+isini(0o-0i)|l)), (1) 

where and are the settings of the two phase shifters and the action of the beam-sphtters is 
defined as 

|0) ;)i(|0) + |l)) 

|1) 72(|0)-Il)) (2) 

(and extends by hnearity to states of the form a | 0) + /? | 1)). Here, we have ignored the e* 2 phase 
shift in the reflected beam, which is irrelevant because the interference pattern depends only on the 
difference between the phase shifts in different arms of the interferometer. The phase shifters in the 
two paths can be tuned to effect any prescribed relative phase shift 4> = 4>q — and to direct the 
particle with probabilities cos^ and sin^ respectively to detectors "0" and "1". 

The roles of the three key ingredients in this experiment are clear. The first beam splitter prepares 
a superposition of possible paths, the phase shifters modify quantum phases in different paths and 
the second beam-splitter combines all the paths together. As we shall sec in the following sections, 
quantum algorithms follow this interferometry paradigm: a superposition of computational paths 
is prepared by the Hadamard (or the Fourier) transform, followed by a quantum function evaluation 
which effectively introduces phase shifts into different computational paths, followed by the Hadamard 
or the Fourier transform which acts somewhat in reverse to the first Hadamard/Fourier transform and 
combines the computational paths together. To see this, let us start by rephrasing Mach-Zehnder 
interferometry in terms of quantum networks. 



2 Quantum gates networks 

In order to avoid references to specific technological choices (hardware), let us now describe our Mach- 
Zehnder interference experiment in more abstract terms. It is convenient to view this experiment as 
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Figure 2: A quantum network composed of three single qubit gates. This network provides a hardware- 
independent description of any single-particle interference, including Mach-Zchndcr interferometry. 
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Figure 3: Phase factors can be introduced into different computational paths via the controUed-C/ 
operations. The controlled-[/ means that the form of U depends on the logical value of the control 
qubit (the upper qubit). Here, we apply the identity transformation to the auxiliary (lower) qubits 
(i.e. do nothing) when the control qubit is in state | 0) and apply a prescribed U when the control 
qubit is in state | 1). The auxiliary or the target qubit is initially prepared in state | -0) which is one 
of the eigenstates of U. 

a quantum network with three quantum logic gates (elementary unitary transformations) operating 
on a qubit (a generic two-state system with a prescribed computational basis {| 0) , 1 1)}). The beam- 
splitters will be now called the Hadamard gates and the phase shifters the phase shift gates (see Fig. ^) . 

The Hadamard gate is the single qubit gate H performing the unitary transformation known as the 
Hadamard transform given by (Eq. 0) 



- H - |0) + (-l) 



(3) 



The matrix is written in the basis {| 0) , | 1)} and the diagram on the right provides a schematic 
representation of the gate H acting on a qubit in state | x), with a; = 0, 1. Using the same notation 



we define the phase shift gate as a single qubit gate such that | 0) > | 0) and | 1) 



pi0 I 



1), 
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(4) 



Let us explain now how the phase shift can be "computed" with the help of an auxiliary qubit (or a 
set of qubits) in a prescribed state | ip) and some controUed-C/ transformation where U \ = e"^ | V') 
(see Fig.|). 

Here the controUcd-C/ is a transformation involving two qubits, where the form of U applied to the 
auxiliary or target qubit depends on the logical value of the control qubit. For example, we can apply 
the identity transformation to the auxiliary qubits (i.e. do nothing) when the control qubit is in state 
I 0) and apply a prescribed U when the control qubit is in state | 1). In our example shown in Fig. ^, 
we obtain the following sequence of transformations on the two qubits 



3 



|0)|^)^^(|0) + |1))|V.) _i=(|0)+e^*|l))|^) 

^ e(*^)(cos||0)+isin||l))|V'). (5) 

We note that the state of the auxiHary register being an eigenstate of [/, is not altered along 
this network, but its eigenvalue e*"^ is "kicked back" in front of the 1 1) component in the first qubit. 
The sequence (j^) is equivalent to the steps of the Mach-Zehnder interferometer and, as was shown 
in PI, the kernel of most known quantum algorithms. 



3 The first quantum algorithm 

Since quantum phases in interferometers can be introduced by some controlled-?/ operations, it is 
natural to ask whether effecting these operations can be described as an interesting computational 
problem. 

Suppose an experimentalist, Alice, who runs the Mach-Zehnder interferometer delegates the control 
of the phase shifters to her colleague. Bob. Bob is allowed to set up any value (f> = (j>o — and Alice's 
task is to estimate 4>. Clearly for general (p this involves running the device several times until Alice 
accumulates enough data to estimate probabilities Pq and Pi, however, if Bob promises to set up (p 
either at or at tt then a single-shot experiment can deliver the conclusive outcome (click in detector 
"0" corresponds to (f> = and in detector "1" corresponds to cf) = tt). The first quantum algorithm 
proposed by David Deutsch in 1985 |^ is related to this effect. 

We have seen in the previous section that a controUed-U transformation can be used to produce a 
particular phase shift on the control qubit corresponding to its eigenvalue on the auxiliary qubit. If 
two eigenvalues of the controUed-U transformation lead to different orthogonal states in the control 
qubit, a single measurement on this qubit will sufhce to distinguish the two cases. 

For example consider the Boolean functions / that map {0,1} to {0,1}. There are exactly four 
such functions: two constant functions (/(O) = /(I) = and /(O) = /(I) = 1) and two "balanced" 
functions (/(O) = 0, /(I) — 1 and /(O) — 1, /(I) = 0). It turns out that it is possible to construct a 
controlled function evaluation such that two possible eigenvalues are produced which may be used to 
determine whether the function is constant or balanced. This is done in the following way. 

Let us formally define the operation of "evaluating" / in terms of the f- controlled- NOT operation on 
two bits: the first contains the input value and the second contains the output value. If the second bit 
is initialised to 0, the /-controUed-NOT maps (x, 0) to {x,f{x)). This is clearly just a formalization 
of the operation of computing /. In order to make the operation reversible, the mapping is defined 
for all initial settings of the two bits, taking (x, y) to {x, y f{x)), where denotes addition modulo 
two. 

A single evaluation of the /-controUed-NOT on quantum superpositions suffices to classify / as con- 
stant or balanced. This is the real advantage of the quantum method over the classical. Classically 
if the /-controUed-NOT operation may be performed only once then it is impossible to distinguish 
between balanced and constant functions. Whatever the outcome, both possibilities (balanced and 
constant) remain for /. This corresponds to our classical intuition about the problem since it involves 
determining not particular values of /(O) and /(I), but a global property of /. Classically to determine 
this global property of /, we have to evaluate both /(O) and /(I), which involves evaluating / twice. 

Deutsch's quantum algorithm has the same mathematical structure as the Mach-Zehnder interferom- 
eter, with the two phase settings = 0, tt. It is best represented as the quantum network shown in 
Fig. ^, where the middle operation is the /-controUed-NOT, which can be defined as: 

\x)\y)^--^''\x)\y®f{x)) . (6) 
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Figure 4: Quantum network which implements Deutsch's algorithm. The middle gate is the /- 
controUed-NOT which evaluates one of the four functions / : {0, 1} ^ {0, 1}. If the first qubit is 
measured to be | 0), then the function is constant, and if | 1), the function is balanced. 

The initial state of the qubits in the quantum network is | 0) (| 0) — 1 1)) (apart from a normalization 
factor, which will be omitted in the following). After the first Hadamard transform, the state of the 
two qubits has the form (| 0) + 1 1))(| 0) — 1 1)). To determine the effect of the /-controlled-NOT on 
this state, first note that, for each x E {0, 1}, 



-N 



I x) (I 0) - 1 1)) ^ I x) (I © fix)) - 1 1 ® fix))) = I x) (I 0) 

Therefore, the state after the /-controlled-NOT is 

((-lK(")|0) + (-lKW|l))(|0)-|l)). 



1» 



(7) 



(8) 



That is, for each x, the | a;) term acquires a phase factor of (— l)-^'^^-', which corresponds to the 
eigenvalue of the state of the auxiliary qubit under the action of the operator that sends | y) to 

\y(sfix)). 

This state can also be written as 



(-l)/(")(|0> + (-lK(°)®/W|l))(|0)-|l», 
which, after applying the second Hadamard transform to the first qubit, becomes 

(-l)-^W|/(0)®/(l))(|0)-|l)). 



(9) 



(10) 



Therefore, the first qubit is finally in state | 0) if the function / is constant and in state | 1) if the 
function is balanced, and a measurement of this qubit distinguishes these cases with certainty. 

The Mach-Zehnder interferometer with phases (j>o and 0i each set to either or tt can be regarded 
as an implementation of the above algorithm. In this case, 0o and respectively encode /(O) and 
/(I) (with TT representing 1), and a single photon can query both phase shifters (i.e. /(O) and /(I)) 
in superposition. More recently, this algorithm (Fig. 4) has been implemented using a very different 
quantum physical technology, nuclear magnetic resonance ^, |^ . 

More general algorithms may operate not just on single qubits, as in Deutsch's case, but on sets of 
qubits or 'registers'. The second qubit becomes an auxiliary register | tp) prepared in a superposition 

of basis states, each weighted by a different phase factor. 



y=o 



\y)- 



(11) 



In general, the middle gate which produces the phase shift is some controlled function evaluation. A 
controlled function evaluation operates on its second input, the 'target', according to the state of the 
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first input, the 'control'. A controlled function / applied to a control state | x) , and a target state | ij}) 
gives 

I I V) ™> I V + . (12) 
where the addition is mod 2™. Hence for the register in state ([ll| ) 



2"-l 

E 

y=0 



(13) 

Effectively a phase shift proportional to the value of f{x) is produced on the first input. 

We will now see how phase estimation on registers may be carried out by networks consisting of 
only two types of quantum gates: the Hadamard gate H and the conditional phase shift R(0). The 
conditional phase shift is the two-qubit gate R('/)) defined as 



R(0) 



10 
10 
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\y) 



e^^y^\x)\y). 



(14) 



The matrix is written in the basis {| 0) | 0) , | 0) 1 1) , 1 1) | 0) , 1 1) 1 1)}, (the diagram on the right shows 
the structure of the gate). For some of the known quantum algorithms, when working with registers, 
the Hadamard transformation, corresponding to the beamsplitters in the interferometer, is generalised 
to a quantum Fourier transform. 



4 Quantum Fourier transform and computing phase shifts 

The discrete Fourier transform is a unitary transformation of a s-dimensional vector 

(/(O), /(I), /(2), . . . , /(s - 1)) ^ (/(O), /(I), /(2), ...,/>- 1)) (15) 

defined by: 

1 

/(y) = ^E^'"''^'/(^)' (16) 



's 

x=0 



where f{x) and f{y) are in general complex numbers. In the following, we assume that s is a power 
of 2, i.e., s = 2" for some n; this is a natural choice when binary coding is used. 

The quantum version of the discrete Fourier transform (QFT) is a unitary transformation which can 
be written in a chosen computational basis {|0), |1), . . . , |2" — 1)} as, 



1 

-r=^e-x:p{2mxy / s) \y) . (17) 



More generally, the QFT effects the discrete Fourier transform of the input amplitudes. If 

QFT:E/(^)l^>--E/(y)l2^)' (18) 

X y 

then the coefficients f{y) are the discrete Fourier transforms of the f{x)^s. 

A given phase (j)^ = 27ra;/2" can be encoded by a QFT. In this process the information about (j>x is 
distributed between states of a register. Let x be represented in binary as xo...Xn-i G {0,1}", 



6 



\X2 



|X3) 



H 



H 



• H 



H 



I _^ g27r«/2 I 
I 0) + e27r«/2^ I 
I 0) + e27r«/2^ I 1^ 
I 0) + e2^»:./2'' 1 1^ 



H R(7r) H R(7r/2)R(7r) H R(7r/4)R(7r/2)R(7r) H 



Figure 5: The quantum Fourier transform (QFT) network operating on four qubits. If the input state 
represents number x = 2''xk the output state of each qubit is of the form | 0) + e*^ "^^ | 1), 
where (px — 27rx/2" and k — 0,1,2 . . .n — 1. N.B. there are three different types of the gate in 

the network above: R{'k), R{'k/2) and R{'k/A). The size of the rotation is indicated by the distance 
between the 'wires'. 



where x = 'Y^=q ^i^^ (and similarly for y). An important observation is that the QFT of x, 
exp(27ria;y/s) \y), is unentangled, and can in fact be factorised as 

(I 0) + e'*- I 1))(| 0) + e^2^- 1 1» • • • (I 0) + e"""'^- 1 1)) . (19) 

The network for performing the QFT is shown in Fig. |^. The input qubits are initially in some state 
I a;) = I Xq) I xi) I X2) I 2:^3) where xqXiX2X^ is the binary representation of x, that is, x = Yl^i=o ^i^^ ■ As 
the number of qubits becomes large, the rotations i?(7r/2") will require exponential precision, which 
is impractical. Fortunately, the algorithm will work even if we omit the small rotations, 

The general case of n qubits requires a simple extension of the network following the same pattern of 
H and R gates. 



States of the form (19) are produced by function evaluation in a quantum computer. Suppose that U 
is any unitary transformation on m qubits and | V') is an eigenvector of U with eigenvalue e"^ . The 
scenario is that we do not explicitly know C/ or | t/i) or e*"^, but instead are given devices that perform 
controlled-t/, controlled-i7^ , controlled- [/^ and so on until we reach controlled-f7^ . Also, assume 
that we are given a single preparation of the state \ From this, our goal is to obtain an n-bit 
estimator of (p. 

In a quantum algorithm a quantum state of the form 

(I 0) + e*2""V I 0) + e'2"-^0 1 1)) ... (I 0) + \ 1)) (20) 
is created by applying the network of Fig. ^ 

Then, in the special case where = 27rx/2", the state | ■ • ■ Xn^i) (and hence 0) can be obtained 
by just applying the inverse of the QFT (which is the network of Fig. ^ in the backwards direction 
and with the qubits in reverse order). If x is an n-bit number this will produce the state | xo ■ • • Xn-i) 
exactly (and hence the exact value 0). 

However, is not in general a fraction of a power of two (and may not even be a rational number). 
For such a, (j) = 27rw, it turns out that applying the inverse of the QFT produces the best n-bit 
approximation of w with probability at least A/tt^ k. 0.41 The probability of obtaining the best|^ 

^Though this process produces the best estimate of ui with significant probabihty, it is not necessarily the best 
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Figure 6: The network which computes phase shifts in Shor's algorithms; it also implements the 
modular exponentiation function via repeated squarings. 



estimate can be made 1 ~ S for any S, < S < 1, hy creating the state in equation 
n + 0(log(l/(5)) qubits and roimding the answer off to the nearest n bits M. 



m but with 



5 Examples 

We will now illustrate the general framework described in the preceding section by showing how some 
of the most important quantum algorithms can be viewed in this light. We start with Shor's quantum 
algorithm for efficient factorisation (for a comprehensive discussion of quantum factoring see |l^, |^] ) . 



5.1 Quantum Factoring 

Shor's quantum factoring of an integer N is based on calculating the period of the function f{x) = 
mod N for a randomly selected integer a between 1 and N. For any positive integer y, we define 
y mod N to be the remainder (between and N~ 1) when we divide y by N. More generally, y mod N 
is the unique positive integer y between and iV — 1 such that N evenly divides y — y. For example, 
2 mod 35 = 2, 107 mod 35 = 2, and —3 mod 35 — 32. We can test if a is relatively prime to N 
using the Euclidean algorithm. If it is not, we can compute the greatest common divisor of a and 
N using the extended Euclidean algorithm. This will factor TV into two factors A^i and N2 (this is 
called splitting N). We can then test if A^i and N2 are powers of primes, and otherwise proceed to 
split them if they are composite. We will require at most log2(A^) splittings before we factor N into 
its prime factors. These techniques are summarised in 

It turns out that for increasing powers of a, the remainders form a repeating sequence with a period 
r. We can also call r the order of a since a*" = 1 mod N. Once r is known, factors of A'' are obtained 
by calculating the greatest common divisor of N and a""/^ ± 1. 

Suppose we want to factor 35 using this method. Let a = 4. For increasing x the function 4^ mod 35 
forms a repeating sequence 4, 16, 32, 29, 9, 1, 4, 16, 29, 32, 9, 1, . . .. The period is r = 6, and a^^^ mod 
35 = 29. Then we take the greatest common divisor of 28 and 35, and of 30 and 35, which gives us 
7 and 5, respectively, the two factors of 35. Classically, calculating r is at least as difficult as trying 
to factor N; the execution time of the best currently-known algorithms grows exponentially with the 
number of digits in N. Quantum computers can find r very efficiently. 



estimator of u), 
for details. 



since, for example, we might be able to to obtain as close an estimate with higher probability. See 
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Consider the unitary transformation Ua that maps | a;) to | ax mod N) . Such a transformation is 
reaHsed by simply implementing the reversible classical network for multiplication by a modulo N 
using quantum gates. The transformation Ua, like the clement a, has order r, that is, UJ^ = I, the 
identity operator. Such an operator has eigenvalues of the form for fc = 0, 1, 2, . . . , r — 1. In 

order to formulate Shor's algorithm in terms of phase estimation let us apply the construction from 
the last section taking 

r-l 

I ^) = ^ I mod N) . (21) 

j=o 

Note that is an eigenvector of Ua with eigenvalue e'^^*'-'^'. Also, for any j, it is possible to 
implement efficiently a controlled- J7^^ gate by a sequence of squaring (since J7^' = U^2i )■ Thus, using 

the state | ^p) and the implementation of controlled- f/^^ gates, we can directly apply the method of 
the last section to efficiently obtain an estimator of i. 

The problem with the above method is that we are aware of no straightforward efRcient method to 
prepare state | ip), however, let us notice that almost any state | ipk) of the form 

r-l 

li'k) = Y.e~^\ mod N) , (22) 

3=0 

where k is from {0, . . . , r — 1} would also do the job. For each k € {0, 1, . . . , r — 1}, the eigenvalue of 
state I V'fc) is e^'^*'"). We can again use the technique from the last section to efficiently determine - 
and if k and r are coprime then this yields ^ r. Now the key observation is that 

r 

\l)=Y.\^k), (23) 
fe=i 

and I 1) is an easy state to prepare. 

If we substituted 1 1) in place of | ip) in the last section then effectively we would be estimating one of the 
r, randomly chosen, eigenvalues e^'^*^^^. This demonstrates that Shor's algorithm, in effect, estimates 
the eigenvalue corresponding to an eigenstate of the operation Ua that maps | x) to | ax mod N). A 
classical procedure - the continued fractions algorithm - can be employed to estimate r from these 
results. The value of r is then used to factorise the integer. 



5.2 Finding hidden subgroups 



A number of algorithms can be generalised in terms of group theory as examples of finding hidden 
subgroups. For any g G G, the coset gK, of the subgroup K is defined as {gK\g g G}. Say we have a 
function / which maps a group G to a set X , and / is constant on each coset of the subgroup K, and 
distinct on each coset, as illustrated in Figure 0. In other words, f{x) = f{y) if and only ii x — y is 
an element of K. 

In Deutsch's case, G = {0, 1} with addition mod 2 as the group operation, and X is also {0, 1}. There 
are two possible subgroups K: | 0), and G itself. We are given a black-box Uf for computing / 

\x)\y)^\x)\y®fix)). 



^If the estimate J//2'" of k/r satisfies 



then there is a unique rational of the form ^ with < b < N satisfying 



y 



1 



Consequently, a/b = k/r, and the continued fractions algorithm will find the fraction for us. We migh 
get a k like 0, but with even 2 repetitions with random k we can find r with probability at least 0.54 



e unlucky and 
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Figure 7: A function / mapping elements of a group G to a set X with a hidden subgroup K. This 
means that f{gi) = f{92) if and only if gi and g2 are in the same coset of K . 



There are two cosets of the subgroup {0}: {0} and {1}. If the function is defined to be constant 
and distinct on each coset, it must be balanced. On the other hand, there is only one coset of the 
other subgroup G, the group itself. In this case the function is constant. With our specially chosen 
eigenvector | 0) — 1 1) the algorithm always outputs | 0) if if = {0,1} (/ is constant), and 1 1) if 
K = {0}, (f is balanced). Therefore we can view Deutsch's algorithm as distinguishing between the 
'hidden subgroups'. 

The hidden subgroup problem also encompasses the problem of finding orders of elements in a group, 
of which the factoring algorithm is a special case. In quantum factoring, we wish to find the order r of 
the element a in some group represented by X . Here G is the group of integers Z and K is the additive 
subgroup rZ of integer multiples of r, where r is the order of a, and a is from the multiplicative group 
of integers modulo N . The function / maps x to mod N . 

The output I y) in this case estimates an element which is orthogonal^ to the subgroup K. The output 
I z) corresponds to the estimate z/2" of the eigenvalue k/r of the operator Ua which maps | a;) to | ax) 
(that is, the operator which maps | f{g)) to | f{g + 1))) on the eigenvector | ■i/'/c)- In general, for any 
function / mapping a finitely generated Abelian group G to a finite set X, the quantum network 
shown in figure |^ will output an estimate of a random element orthogonal to the hidden subgroup K . 
With enough such elements, we can easily determine K using linear algebra. 

By framing algorithms in terms of hidden subgroups, it may be possible to think of other problems 
associated with this structure in groups which we can treat with quantum algorithms. A number 
of algorithms have already been cast in this language, including Deutsch's problem Simon's 
problem |l^, factoring integers finding discrete logarithms Abelian stabilisers ^|, self-shift- 
equivalences [pi, and others [|l5| (see |l6| and pTl for details). 



5.3 Quantum Counting and Searching 

The first quantum algorithm for searching was constructed by Grover [|l8j. This has led to a large 
class of searching and counting algorithms. 

^By orthogonal here, we are not referring to the orthogonality of states in our computational Hilbert space. When 
we say k/r is orthogonal to i^" = rZ, we mean that exp(27rj2^) = 1 for every z € K. This notion of orthogonality 
generalises to groups with several generators as well. 
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Figure 8: The generic structure of a quantum network solving any instance of the hidden subgroup 
problem. The first register contains tuples of integers corresponding to the Abelian group G. The role 
of the first Fourier transform is to create a superposition of many computational paths corresponding 
to different elements of G. The evaluation of the function simply kicks phases back into the control 
register states, and the final inverse Fourier transform produces the estimates of the eigenvalues of 
operators related to the function /. The set of eigenvalues corresponding to a particular eigenvector 
produces an element orthogonal to K. By collecting enough such orthogonal elements we can efficiently 
find a generating set for K. 



We again consider a function /, this time mapping us from a set X to the set {0, 1}. 

We might wish to decide if there is a solution to f{x) — 1 ( the decision problem) , or to actually find 
a solution to f{x) = 1 (the searching problem). We might be more demanding and want to know how 
many solutions x there are to f{x) = 1 [counting problem). Small cases of the searching ^ and 
counting pl| algorithms have been implemented using NMR technology. 

In this section we will show how approximate quantum counting can easily be phrased as an instance of 
phase estimation, and quantum searching as an instance of inducing a desired relative phase between 
two eigenvectors. 

In the following sections analysing quantum counting and searching, we will be considering the Grover 
iterate 

G ^ -AUoA-^ Uf (24) 

which was defined in [|l8j with A as the Hadamard transform. It was later generalised in p^ , 
and with A being any transformation such that A \ 0) contains a solution to f{x) = 1 with 
non-zero amplitude, i.e. | (x | A | 0) p > for some x with f{x) — 1. The operator U f maps 

for all X satisfying f{x) — 1, and the operator Uq maps 

|0)--|0) 

leaving the remaining basis states alone. Note that this Uf is slightly different than the standard Uf 
which maps | | 6) to | x) | 6 ® f{x)), but can be easily obtained from it by setting | 6) to | 0) — 1 1). 
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5.3.1 Quantum Counting 



Quantum counting was first discussed in [ p5[ , where it was observed that the Grover iterate is almost 
periodic with a period dependent on the number of solutions. Therefore the techniques of period- 
finding, as in Shor's algorithm, were applied ||2^. It is also possible to think of the problem as a phase 
estimation (see p6t). 

We simply observe that the eigenvalues^ of G are 1, —1, e^'^*"^ , and e^^^^^^J where f{x) = 1 has j 
solutions and 



e 



1 - 23 /N + 2i^j/N -{j/Ny. 



Let X\ denote the set of solutions to f{x) — 1, and Xq denote the set of solutions to f{x) = 0. 
Estimating ujj (or —ojj) will give us information about the number of solutions to f{x) = 1. For 
example, for small ujj, the number of solutions, j, is roughly Nn'^Wj since cos(27ra;j) = 1 — 2j/N w 
1 — 27r^cj| for small u!j. 

We can use the techniques of the previous sections to estimate this phase tuj provided we know how to 
create a starting state containing the eigenvectors with eigenvalues e^'^"^^ and e"^'^"^^ . For non-trivial 
J, these eigenvectors are given by 

|V+)-4s(|Xi)+*|Xo)) (25) 



V2' 



V-) = 4(l^i>-*l^o)) (26) 



where 



|Xi) = ^ |x) (27) 

^■^ /(^)=i 

1^0) = ^ El-)- (28) 



Fortunately, the starting state 



is equal to 



N-l 



x=0 



1 



^(e-2-»e. I + e2-'«^- I ^_)) (29) 
v2 

for some real number which is not important as far as counting is concerned, since all that is 
required for the phase estimation procedure is any superposition of these two eigenvectors of G. 

Thus using a controUed-G, controUed-G^, . . . , and a controUed-G'^ , (as done with controlled-J7s in 
Figure ^ and applying a quantum Fourier transform, we can get an n-bit estimate of either ujj or 
—ujj. This gives us an estimate of j, the number of solutions. Note that, unlike in the case of finding 
orders, there are in general no short-cuts for computing higher powers of G. That is, computing G^ 
requires 2" repetitions of G. 

Quantum algorithms for approximate counting require roughly only square root of the number of calls 
a classical algorithm would require. 

*The eigenvalue —1 has multiplicity j ~ 1, 1 has multiplicity N — j — 1, and e'^'^"^ and e"-^'^*" each have multiplicity 
1. If j = 0, then 1 has multiplicity N, (note that e^'^'^^o = f,-2ni^o = i)^ if j = 7V, then -1 has multipUcity N, 

j-g27riujv _ g-27riL;jv = — 1). 



12 



5.3.2 Quantum searching 



While estimating the number of solutions to /(x) = 1 is a special case of quantum phase estimation, 
the algorithm for searching for these solutions can be viewed as a clever use of the phase kick-back 

technique to induce a desired relative phase between two eigenvectors of G. The state | Xi) is a 
superposition of solutions to f{x) = 1, so it is itself a solution which it is possible for us to construct. 

We note that 

|Xi) = |V+) + |V-) (30) 
and our starting state for quantum searching is 

A I 0) = I V+) + e^^^^^^ I V-) . (31) 

Each iteration of G kicks back a phase of e^'^*'^^ in front of | and e"^'^*'^^ in front of | V'-)- So fc 
iterations of G produces the state 

v2 

Since we seek 

|Xi) = i=(|V+) + |V-)) 
we want to choose the number of iterations k so that 



kujj ~ 6j (33) 

is as close to an integer as possible. When j is small, this means selecting the number of iterations 
close to 

^VWj- (34) 

Note that any classical algorithm would require N/j evaluations of / before finding a solution to 
f{x) = 1 with high probability. 



6 Concluding remarks 

Multi-particle interferometers can be viewed as quantum computers and any quantum algorithm 
follows the typical structure of a multi-particle interferometry sequence of operations. This approach 
seems to provide an additional insight into the nature of quantum computation and, we believe, 
will help to unify all quantum algorithms and relate them to different instances of quantum phase 
estimation. 
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